Casper's Life

  If you are trying to get Docker and KVM to work on the same host then you will find that the networking is a  bit icky. You'll need to tell iptables to allow forwarding on your network interface. As I always to things using a bridge (makes it easier to change network card if needed), I use br0 in this example. cat /dev/null [Unit] Description = Apply iptables rules [Service] Type=oneshot ExecStart=/bin/sh -c 'iptables -A FORWARD -i br0 -o br0 -j ACCEPT' [Install] WantedBy=network-online.target EOF   Then you need to enable it and restart the service (I'd restart the host): sudo systemctl daemon-reload \ && sudo systemctl enable restore-iptables-rules.service \ && sudo systemctl start restore-iptables-rules.service   That should be it, now your KVM guests will be able to reach the network. (there, of cause will be other things like enabling of forwarding which is also required). 

 Due to macvlan instability, I moved my "public" network from macvlan to ipvlan. While I was doing this, I ran in to a problem which caused my no end of grief. No matter what I did, I could not get my ipv6 to work, ipv4 did work, but not ipv6. I was following bobcares:Alpine Docker enable IPv6 : How to? instructions to the letter, or so I thought.  My configuration was: docker network create -d ipvlan -o parent=eth0 \ --subnet 10.10.43.0/24 \ --gateway 10.10.43.1 \ --subnet "fd80:1::/64" \ --gateway "fd80:1::1" \ --ipv6 \ public   No matter what I would, it did not work. Then suddenly I rememberd, in another setup (which also took a while to get working), I had to move "-o parent=eth0" to the end, like: docker network create -d ipvlan \ --subnet 10.10.43.0/24 \ --gateway 10.10.43.1 \ --subnet "fd80:1::/64" \ --gateway "fd80:1::1" \ --ipv6 \ -o parent=eth0 pu...

I have been using macvlan for a very long time, and have had no problems what so ever. Now suddenly I started having an issue which would lock up my box (I'm running +25 containers), the box would run for everything from 15 minutes to 24 hours (sometimes longer) but it would lock up. The only notification I would get would be an exception like this in dmesg: Oct 21 00:51:10 kernel: [22600.504145] ------------[ cut here ]------------ Oct 21 00:51:10 kernel: [22600.504183] WARNING: CPU: 0 PID: 303960 at net/netfilter/nf_conntrack_core.c:1123 __nf_conntrack_confirm+0x3ff/0x480 [nf_conntrack] Oct 21 00:51:10 kernel: [22600.504186] Modules linked in: tcp_diag udp_diag inet_diag xt_nat xt_tcpudp veth macvlan xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user nft_counter xt_addrtype nft_compat nf_tables nfnetlink br_netfilter overlay bridge stp llc mlx5_core(OE) mlxfw(OE) mlxdevm(OE) auxiliary(OE) mlx_compat(OE) p...

If you like me have a box which is running everything, like; Docker, kvm and lxc then you probably also once in a while get gray hair from sorting out networking.  So Docker like to control networking and I let it - only exception is that I'm having a separate bridge (macvlan) for everything Docker as it does sometimes makes life easier (not often). But as Docker see everything, even with multiple network cards / bridges as one whole, it does apply it's iptables rules to everything. Which does cause some problems for kvm and lxc.  One easy way to allow communcation to the kvm vm's via your bridge (if you use bridged networking) is to allow it: iptables -A FORWARD -i br0 -o br0 -j ACCEPT Replace 'br0' with what ever you use as bridge for kvm / lxc. To have this to execute automatically everytime you retart networking (reboot the box) create the following file: /etc/systemd/system/restore-iptables-rules.service With this content: [Unit] Description = Apply iptab...

I for one, maybe not everyone, but I for a long time though that to be able to communicate with a docker instance I had to be on that box. First, after digging around I found the DOCKER_HOST environment variable, which served it purpose, and allowed me to connect to one or more of my docker hosts; $ export DOCKER_HOST="ssh://me@dockerhost $ docker ps CONTAINER ID IMAGE... 1b2e8e4a546a casperghst42/pms-docker... 4de622e79fa6 casperghst42/httpserver... ... Now after (unsuccessly) having looked at VS Code and it's Docker extension (which as of writing is broken in more than one way), I discovered Docker Contexts. Instead of using DOCKER_HOST one should use docker contexts , which allow to setup multiple hosts to connect to. Example: $ docker context ls NAME           TYPE           DESCRIPTION default        moby           Current DOCKER_HOST based dockerhost...